Anomaly detection method of time series data in special fuel transportation process based on RNN and DTW

Abstract

The present invention discloses a method for detecting abnormality of special fuel delivery process time series data based on RNN and DTW. First, the historical data of sensors collected by the monitoring system of the special fuel delivery process is obtained. In the offline training stage, RNN is used to divide the data under normal working conditions into a training sequence set and a reference sequence set. The training sequence set is mapped to a training sequence feature set through RNN. The similarity between the reference sequence and the training sequence set is compared one by one. The similarity warning and alarm threshold are determined through the reference sequence set. During online detection, when the similarity between the real-time sequence and the most similar sequence in the training sequence set exceeds the threshold, an early warning and alarm are performed. The present invention can detect abnormalities of special fuel delivery process time series parameters in real time and stably under complex dynamic nonlinear and multi-operating conditions. It can effectively deal with the problem of abnormal detection of key parameters under the condition of imbalance of abnormal samples in high safety and reliability scenarios. It has fast detection speed and low false negative rate, and can realize industrial-grade real-time detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of abnormality detection of industrial control systems, and in particular relates to a method for detecting abnormality of time series data in a special fuel transportation process based on RNN and DTW. Background Art

[0002] Anomaly detection technology can discover hidden dangers and problems in the operation of industrial process monitoring systems, reduce unexpected downtime and maintenance costs, and improve system safety; especially in high-safety and high-reliability scenarios such as flammable, explosive, and highly toxic special fuel transportation systems. Process time series data has complex dynamic changes, nonlinearity, and multiple operating conditions. Timely and accurate anomaly detection is particularly important, which can play an important role in reducing safety hazards and preventing major safety accidents.

[0003] Existing methods and devices for detecting anomalies in time series data mainly use simple threshold judgment, statistical learning and machine learning, and generally have the following defects: (1) The simple threshold judgment method does not provide timely warning under nonlinear and complex dynamic conditions; (2) The statistical learning method is mainly based on the assumption that data obeys Gaussian distribution, and the detection accuracy is not high when the data in the actual production environment is not Gaussian; (3) Machine learning methods such as the literature [Li Zhiqiang. Research on anomaly detection methods for time series data in process industry [D]. Guangzhou University, 2024] are extremely difficult to obtain abnormal samples in scenarios with high safety requirements. The existing methods and means for enhancing time series data are limited, making it difficult to achieve widespread engineering applications. In addition, the cost of data annotation is high, and the efficiency is extremely low in situations such as process monitoring where models need to be updated in a timely manner; (4) The standard DTW (Dynamic Time Warping) method has a time complexity of O(2) for calculating the similarity between two sequences. n 2 ), n For the length of the time series data, even if the improved algorithms such as FastDTW [Salvador S, Chan P. Toward accurate dynamic timewaring in linear time and space[J]. Intelligent Data Analysis, 2007, 11(5):561-580] can reduce the computational time complexity to O( n ), but still need to compare and calculate in a huge training set, and the running time of a single variable detection has reached seconds, which is difficult to meet the requirements of simultaneous online real-time detection of multi-dimensional variables.

[0004] Therefore, how to avoid the above defects and improve the adaptability, accuracy and real-time performance of time series data anomaly detection under the conditions of complex dynamic changes, nonlinearity and multiple working conditions in the special fuel transportation process is an urgent problem to be solved. Summary of the invention

[0005] In view of the above, the present invention provides a method for detecting anomalies in time series data of special fuel transportation processes based on RNN and DTW. Aiming at the complex dynamic changes, nonlinearity, and multiple working conditions of the monitoring data of the flammable, explosive, and highly toxic special fuel transportation processes, the feature mining capability of neural networks is utilized. According to the model and data characteristics, anomaly detection indicators are designed, the similarity calculation method is improved, and the calculation efficiency is improved to achieve real-time detection.

[0006] A method for detecting anomaly of time series data in a special fuel transportation process based on RNN and DTW includes the following steps:

[0007] (1) Obtaining historical data sequences of the variables to be measured under normal operating conditions of the special fuel delivery monitoring system, and dividing these data sequences into a training sequence set and a benchmark sequence set;

[0008] (2) Use the training sequence set to train the RNN (Recurrent Neural Network), and then use the trained RNN to extract features from the data sequences in the training sequence set and the benchmark sequence set;

[0009] (3) Determine the early warning benchmark value and alarm benchmark value for time series data anomaly detection based on the extracted features;

[0010] (4) The real-time data sequence of the measured variable is input into the trained RNN to extract the corresponding features, and then anomaly detection is performed on the real-time data sequence of the measured variable based on the features as well as the early warning baseline value and the alarm baseline value.

[0011] Furthermore, the variables to be measured include pressure, flow, temperature, current, etc. of each measuring point in the monitoring system.

[0012] Furthermore, in step (2), each data sequence in the training sequence set and the binary state quantity related to the change during the monitoring process (i.e., the stage state category corresponding to the data sequence) are used as the training input data and label data of the RNN, so as to train the RNN.

[0013] Furthermore, in step (2), the data sequences in the training sequence set and the reference sequence set are input into the trained RNN one by one, and the output features of the hidden layer in the RNN are taken as the features of the data sequence.

[0014] Furthermore, the specific implementation of step (3) is as follows: for any data sequence in the benchmark sequence set p , use the lock-step metric method to calculate the similarity between its features and the features of each data sequence in the training sequence set (such as Euclidean distance); take the features in the training sequence set that are similar to the data sequence p The k data sequences with the highest feature similarity between them constitute a similar sequence set, where k is a natural number greater than 1; the elastic measurement method is used to calculate the data sequence p The similarity between each data sequence in the similar sequence set (such as DTW), taking the smallest similarity as the data sequence p Detection index REF; Based on the above, the detection index REF of each data sequence in the benchmark sequence set is traversed, and the early warning benchmark value of time series data anomaly detection is calculated and determined according to these REFs by the Gaussian kernel density estimation method (confidence level is 0.9~0.997), and the maximum value of these REFs is taken as the alarm benchmark value of time series data anomaly detection.

[0015] Furthermore, in step (4), the real-time data sequence of the variable to be measured is q After extracting its features through RNN, the Euclidean distance between the feature and each data sequence feature in the training sequence set is calculated as the similarity; q The k data sequences with the highest feature similarity constitute a similar sequence set, where k is a natural number greater than 1; the truncation strategy is used to calculate the data sequence q The DTW similarity between each data sequence in the similar sequence set, taking the smallest DTW similarity as the data sequence q If the REF is greater than the warning reference value, the data sequence is determined to be q Detect abnormalities and start early warning; if REF is greater than the alarm reference value, an alarm is issued directly.

[0016] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor is used to execute the computer program to implement the above-mentioned RNN and DTW-based special fuel transportation process time series data anomaly detection method.

[0017] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method for detecting anomalies in time series data of a special fuel delivery process based on RNN and DTW is implemented.

[0018] Based on the above technical solution, the present invention has the following beneficial technical effects:

[0019] 1. The present invention adopts the RNN model during offline training, and directly uses the binary state quantities related to the monitoring process changes as training labels, without the need for manual sample labeling. At the same time, it integrates the rich working condition change information contained in the binary state quantities in process monitoring, and enhances the interpretability of the neural network to a certain extent.

[0020] 2. During online detection, the present invention maps time series data of unequal lengths to the same feature dimension through RNN, and uses the lock-step measurement method to quickly calculate the sequence similarity. The complexity of the relative elastic measurement algorithm decreases exponentially, greatly improving the calculation efficiency.

[0021] 3. The present invention adopts the elastic measurement method to calculate the similarity by comparing only the most similar sets and the truncation strategy, which further improves the calculation efficiency and makes the real-time detection time of high-dimensional variables within seconds, meeting the real-time requirements of engineering applications.

[0022] 4. Due to the good characteristics of the method of the present invention, such as short time consumption and no missed detection, the online detection method can also be used for offline anomaly detection. The batch sequence data is divided into real-time sequence sets through sliding windows, which can be used to quickly analyze and demonstrate the order of occurrence of multiple variable anomalies after a fault, so as to facilitate the root cause tracing of complex faults.

[0023] 5. In the case where a new sequence pattern may generate a false alarm, the present invention can add the new sequence pattern to the training set or the benchmark sequence set after manually determining it as a normal sample, thereby completing the incremental update of the training set and the benchmark sequence set and realizing continuous optimization of the model.

[0024] 6. The present invention can analyze the REF value, the early warning reference value and the alarm reference value in combination with actual production, and judge the severity and development of the abnormality in combination with the early warning and alarm intervals. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 The present invention is a flow chart of a method for detecting abnormality in time series data of a special fuel transportation process.

[0026] Figure 2 This is a simplified process diagram of a special fuel delivery monitoring system.

[0027] Figure 3 Schematic diagram of the calculation of DTW similarity of time series. DETAILED DESCRIPTION

[0028] In order to describe the present invention more specifically, the technical solution of the present invention is described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0029] like Figure 1As shown, the method for detecting anomaly of time series data in the special fuel transportation process based on RNN and DTW of the present invention mainly includes two parts: offline modeling and online detection. The specific steps are as follows:

[0030] S1: First, obtain a special fuel delivery monitoring system (the process flow is simplified as follows Figure 2 The time series historical data under normal working conditions (as shown in FIG) are divided into a training sequence set and a benchmark sequence set, and there is no need to perform normalization, filtering, etc. on the original data.

[0031] S2: Offline training stage: The binary state quantity related to the change in the monitoring process of the measured variable is used as the output label to train the RNN model, and the training sequence set is mapped to the training sequence feature set. Then, the benchmark sequence set is mapped to the benchmark sequence feature set through the trained RNN model, and the Euclidean distance between each feature in the benchmark sequence feature set and the training feature set is compared one by one as the similarity of the two time series. The original training sequences corresponding to the first k=10 most similar features are selected to obtain the most similar sequence set in the offline training stage; finally, the DTW similarity between each sequence in the benchmark sequence set and the most similar sequence set is calculated one by one, and the minimum value of the k similarities of the most similar sequence set is taken as the detection value of the benchmark sequence to obtain the benchmark sequence set similarity. The Gaussian kernel probability density of the benchmark sequence set similarity is used as the warning benchmark threshold, and the maximum value of the DTW similarity of the benchmark sequence set is used as the alarm benchmark threshold. The specific implementation process is as follows:

[0032] S21: collected 27 times (fixed process, repeated cycle N The data of a special fuel delivery process under normal working conditions is divided according to the number of times, of which 17 times are training sets and 10 times are benchmark sequence sets. The length of the benchmark sequence is set by the autocorrelation coefficient. L base =300, use the step window to serialize the data set to obtain the training sequence set X train and the benchmark sequence set X base , X train Middle i The sequence is , X base Middle j The sequence is , m is the variable dimension. This embodiment performs abnormal detection on a certain circuit pressure. m =1.

[0033] S22: Set the training sequence X trainInput the RNN model, and use the binary state quantities related to the changes in the monitoring process of the variables to be detected as training labels, including 13 state quantities such as the stage marks of the fuel delivery process, such as full speed / deceleration / replenishment, and the marks of delivery to different target containers. Set the number of RNN output layer features output_size=13 (equal to the number of selected binary state quantities), take the hidden layer size hidden_size=32, minimize the loss function through the iterative method, and perform forward propagation until the model parameters converge or reach the maximum number of iterations epochs=1000, obtain the trained model, and take the final output of the hidden layer h t is the training sequence feature set, specifically:

[0034] (1) X train Input the RNN model and get the hidden layer output of the RNN h t = f (U e x t +W e h t-1 ),in h t and h t-1 Respectively represent t Moment and t -1 hidden layer output, f ( ) represents a nonlinear activation function, U e represents the weights that map the input to the hidden features of the RNN, , h e is the number of nodes in the RNN hidden layer, x t represent t The input sample at time t, W e Indicates that RNN t The hidden layer output at time -1 is mapped to the RNN t The weight of the hidden layer output at time , .

[0035] (2) During the RNN model training process, the stochastic gradient descent method is used, and the parameter learning rate is dynamically adjusted through the Adam optimizer. The learning rate lr is set to 0.0001; the loss function uses the mean square error loss:

[0036]

[0037] in: n is the number of training sequences, yi is the true label value, Predict output values ​​for the model.

[0038] S23: Set the benchmark sequence X base Input the trained RNN model to obtain the benchmark sequence feature set, compare each benchmark sequence feature in the benchmark sequence feature set with the training feature set one by one, calculate their similarity using Euclidean distance, take the original training sequences corresponding to the first k=10 similar features to form the most similar feature set, and calculate the DTW similarity between the benchmark sequence and the most similar sequence set one by one, as shown in Figure 3 As shown, the similarity between sequence 1 and sequence 2 is recursively calculated by the minimum cumulative distance, that is:

[0039] D ( i , j ) =d ( i , j )+min[ D ( i -1, j ), D ( i , j -1), D ( i -1, j -1)]

[0040] in: d ( i , j ) represents the first i elements and the first j The Euclidean distance between elements;

[0041] The minimum DTW similarity among the first k most similar sequences is taken to obtain the detection index REF of each benchmark sequence. The warning benchmark value REF is calculated by using the Gaussian kernel density estimation method and taking the confidence level as 0.9. warn =0.0297, the maximum REF value of the reference sequence set is used as the alarm reference value REF alarm =0.0963.

[0042] S3: Online detection stage: The real-time sequence is mapped through RNN to obtain the real-time sequence features, and then the similarity between the real-time sequence features and the training feature set is calculated one by one. The original sequences corresponding to the first k=10 most similar features are selected from the training feature set to obtain the most similar sequence set in the online stage. The DTW similarity between the most similar sequence set and the real-time sequence is calculated one by one. The minimum DTW distance of the most similar sequence set is taken as the real-time sequence similarity. The early warning and alarm benchmark thresholds are used for anomaly detection. The specific implementation process is as follows:

[0043] S31: Set the real-time sequence length to L test =10, input the real-time sequence into the RNN model trained by S22, take the hidden layer output to get the real-time sequence features. Since the hidden layer output feature dimensions of the RNN model are the same, that is, the real-time sequence features and the training feature set dimensions are the same, the Euclidean distance can still be used to quickly calculate the similarity between the real-time sequence features and the training feature set, and get the first k=10 similar features.

[0044] S32: Take the original reference sequences corresponding to the first k similar features to obtain the most similar sequence set, calculate the DTW similarity between the most similar sequence set and the real-time sequence, and take the minimum DTW distance as the detection value REF; since the real-time sequence is different from the original sequence in length, this embodiment adopts a truncation strategy, that is, only compare the min{ L test , L base}, the single sequence comparison calculation is stopped.

[0045] S33: The real-time detection value REF and the reference threshold REF warn and REF alarm When the comparison is made and the warning reference value is exceeded, an abnormality is detected.

[0046] The above description of the embodiments is to facilitate the understanding and application of the present invention by those skilled in the art. It is obvious that those skilled in the art can easily make various modifications to the above embodiments and apply the general principles described herein to other embodiments without creative work. Therefore, the present invention is not limited to the above embodiments. Improvements and modifications made by those skilled in the art to the present invention based on the disclosure of the present invention should be within the protection scope of the present invention.

Claims

1. A method for detecting anomaly of time series data in a special fuel transportation process based on RNN and DTW, comprising the following steps: (1) obtaining a data sequence of the history of the variables to be measured under normal working conditions of the special fuel delivery monitoring system, and dividing the data sequence into a training sequence set and a reference sequence set; (2) Using the training sequence set to train the RNN, and then using the trained RNN to extract features from the data sequences in the training sequence set and the benchmark sequence set; (3) Determine the early warning reference value and alarm reference value of time series data anomaly detection based on the extracted features. The specific implementation method is as follows: for any data sequence p in the benchmark sequence set, use the lock-step measurement method to calculate the similarity between its features and the features of each data sequence in the training sequence set; take the k data sequences in the training sequence set with the highest feature similarity to the data sequence p to form a similar sequence set, where k is a natural number greater than 1; use the elastic measurement method to calculate the similarity between the data sequence p and each data sequence in the similar sequence set, and take the smallest similarity as the detection index REF of the data sequence p; based on the above, traverse to obtain the detection index REF of each data sequence in the benchmark sequence set, and calculate the early warning reference value of time series data anomaly detection based on these REFs by using the Gaussian kernel density estimation method, and take the maximum value of these REFs as the alarm reference value of time series data anomaly detection; (4) Inputting the real-time data sequence of the measured variable into the trained RNN to extract the corresponding features, and then performing anomaly detection on the real-time data sequence of the measured variable according to the features and the early warning reference value and the alarm reference value; For the real-time data sequence q of the variable to be measured, after extracting its features through RNN, Calculate the Euclidean distance between the feature and each data sequence feature in the training sequence set as the similarity; select the k data sequences with the highest feature similarity with the data sequence q in the training sequence set to form a similar sequence set, where k is a natural number greater than 1; use the truncation strategy to calculate the DTW similarity between the data sequence q and each data sequence in the similar sequence set, and take the smallest DTW similarity as the detection index REF of the data sequence q; if the REF is greater than the warning reference value, it is determined that the data sequence q is abnormal and starts to warn; if the REF is greater than the alarm reference value, an alarm is directly issued.

2. According to claim 1, a method for detecting anomalies in time series data of a special fuel transportation process based on RNN and DTW is characterized in that: The variables to be measured include pressure, flow, temperature and current at each measuring point in the monitoring system.

3. According to claim 1, a method for detecting anomalies in time series data of a special fuel transportation process based on RNN and DTW is characterized in that: In the step (2), each data sequence in the training sequence set and the binary state quantity related to the change during the monitoring process are used as the training input data and label data of the RNN, so as to train the RNN.

4. The method for detecting anomaly of time series data in a special fuel transportation process based on RNN and DTW according to claim 1 is characterized in that: In the step (2), the data sequences in the training sequence set and the reference sequence set are input into the trained RNN one by one, and the output features of the hidden layer in the RNN are taken as the features of the data sequence.

5. A computer device comprising a memory and a processor, wherein a computer program is stored in the memory, wherein: The processor is used to execute the computer program to implement a method for detecting anomalies in time series data of a special fuel transportation process based on RNN and DTW as described in any one of claims 1 to 4.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the method for detecting anomalies in time series data of a special fuel transportation process based on RNN and DTW as described in any one of claims 1 to 4.

Images